Unable to add statement to 'Tenant Admin Policy' in OCI

I've been with OCI over 10 years, from the early days of their Gen1 cloud. So I've seen a lot in the journey of changes. One area of evolution is within their IdAM.

Problem

When trying to add a new statement to the default Tenant Admin Policy, as shown in the screenshot below, the following error is returned:

Cannot update policy - Tenant Admin Policy. Only Service Principal can update this policy

Solution

Oracle Doc ID 2926959.1 explains this a bit, although in not so good words. Basically, you cannot update the default Tenant Admin Policy.

In essence, a Service Principal is not the default admin but is basically an internal OCI service. Thus, this policy cannot be updated.

Simply create a new policy (e.g., Tenant_Admin_Policy_Custom) and add your statement.